SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
65,764 visible repositories in the index
1–15 of 15 · Most stars
Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
- gau
- wayback-machine
- hacktoberfest
- security
Fetch all the URLs that the Wayback Machine knows about for a domain
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
- malware
- virustotal
- malpedia
- urlhaus
My simple Swiss Army knife for http/https troubleshooting and profiling.
- https-troubleshoting
- http-requests
- httptracer
- redirect-urls
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
- endpoints
- endpoint-discovery
- bugbounty
- crawler
Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing
- parameter-finder
- parameter
- bugbounty
- content-discovery
JSFinder is a tool for quickly extracting URLs and subdomains from JS files on a website.
Modern data layer for TypeScript apps - type-safe ORM, built-in access control, automatic query services
- fullstack
- nextjs
- orm
- authorization
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
Authentication built for Nuxt! Easily add authentication via OAuth providers, credentials or Email Magic URLs!
- authentication
- nuxt
- users
- session
A production-ready SaaS template built with Next.js 15, Supabase, and Tailwind CSS. Includes authentication, user management, file storage, task management demos, and secure RLS policies. Now with a complete React Native + Expo mobile app template! Easily customizable with pre-built themes, i18n support (EN/PL/ZH), and legal documents.
Firebase Authentication Middleware for Go Fiber framework.
Express honeypot for RFI and LFI bots: 310 fake vulnerable URLs, logs IP, geolocation and payloads. Docker bait server or app.use() middleware.
Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).
- bugbounty
- cdx
- cli
- kali-linux